PaperlayerView exact revision on arXiv

Source-linked AI summary

Generative Adversarial Networks: A Survey Towards Private and Secure Applications

Zhipeng Cai, Zuobin Xiong, Honghui Xu, Peng Wang, Wei Li, Yi Pan

arXiv:2106.03785v1cs.LGcs.CR

TL;DR

Although GANs have enabled realistic data generation and privacy- and security-oriented research, comprehensive surveys of these applications were lacking. This paper systematically classifies and analyzes state-of-the-art GAN methods, finding broad applications alongside unresolved challenges and future research needs.

  • Problem

    Comprehensive surveys of GAN applications in privacy and security were lacking despite growing research in the area.

  • Method

    The paper systematically reviews GAN-based privacy and security approaches across applications, attack and defense purposes, and performance considerations.

  • Results

    The survey covers applications including image generation, video event detection, records publishing, distributed learning, malware detection, and fraud detection, and identifies unsolved challenges.

  • Takeaways & Limitations

    GAN privacy and security research spans diverse applications, with future improvements needed in application scenarios, model design, and data utilization.

  • Takeaways & Limitations

    Existing GAN-based privacy methods lack theoretical guarantees because black-box synthesis and unstable adversarial training make privacy protection unpredictable.

Abstract

from arXiv · show

Generative Adversarial Networks (GAN) have promoted a variety of applications in computer vision, natural language processing, etc. due to its generative model's compelling ability to generate realistic examples plausibly drawn from an existing distribution of samples. GAN not only provides impressive performance on data generation-based tasks but also stimulates fertilization for privacy and security oriented research because of its game theoretic optimization strategy. Unfortunately, there are no comprehensive surveys on GAN in privacy and security, which motivates this survey paper to summarize those state-of-the-art works systematically. The existing works are classified into proper categories based on privacy and security functions, and this survey paper conducts a comprehensive analysis of their advantages and drawbacks. Considering that GAN in privacy and security is still at a very initial stage and has imposed unique challenges that are yet to be well addressed, this paper also sheds light on some potential privacy and security applications with GAN and elaborates on some future research directions.

1 INTRODUCTION

GAN has expanded generative modeling across data-driven applications, while its adversarial optimization has motivated privacy and security research. This survey organizes existing work, analyzes its limitations, and identifies future directions.

  • GAN has influenced machine learning applications including image generation, super-resolution, and text data manipulation.
  • The survey classifies GAN privacy and security applications, analyzes their advantages and drawbacks, and discusses open directions across application scenarios, model design, and data utilization.
  • Earlier generative models faced computational tractability and representation challenges when modeling high-dimensional, complex data distributions.
  • Current GAN research addresses application-oriented data generation alongside theory-oriented issues such as unstable training, mode collapse, vanishing gradients, and evaluation.
  • Adversarial training models attacker–defender interactions as a min-max game, supporting both privacy attacks and defenses without predetermined opponent assumptions.

2 PRELIMINARIES

GAN uses adversarial training between a generator and discriminator, and its variants modify conditioning, objectives, architectures, or training procedures. The survey presents these variants according to their improvement focuses and application capabilities.

  • GAN maps latent noise z to realistic-looking fake data, while a discriminator distinguishes generated samples from real data in a min-max game.
  • Loss Function: WGAN uses Wasserstein distance to address mode collapse to some extent, while LSGAN modifies discriminator loss with a-b coding to tackle vanishing gradients.
  • Latent Space: cGAN conditions both generator and discriminator on auxiliary information such as class labels or data from other modalities.
  • Latent Space: InfoGAN maximizes mutual information between labels and generated data, whereas ACGAN uses an auxiliary classifier to learn label-related representations.
  • Network Structure: DCGAN uses CNNs for efficient image and video generation, ProGAN progressively increases resolution and depth, and SAGAN adds self-attention for global dependencies.
  • Network Structure: MsgGAN connects generator and discriminator latent spaces while training across multiple datasets to share more information and address limited distribution overlap.

3 PRIVACY OF DATA

GAN-based data privacy methods span image, video, text, speech, spatio-temporal, and graph data. They use generators and discriminators to hide sensitive information while preserving selected data utility.

  • GAN privacy applications cover six data types: image, video, text, speech, spatio-temporal, and graph data.
  • Image Data Privacy: Image methods protect identity, biometric attributes, medical information, street-view content, and other sensitive regions through synthesis, anonymization, steganography, or encoding.
  • Image Data Privacy: Multi-discriminator VGAN balances image quality, identity concealment, and expression preservation for privacy-preserving facial expression recognition.
  • Image Data Privacy: DCGAN-based encoders preserve utility-related variables while hiding sensitive variables in learned representations.
  • Video Data Privacy: Video face anonymization hides faces while retaining information needed for continuous action recognition.
  • Textual Data Privacy: Text privacy methods include anonymous text synthesis and privacy-preserving release of public or medical records.
  • Graph Data Privacy: Graph reconstruction with Laplace noise produces anonymous graphs that retain link-prediction utility and defend against community detection and de-anonymization attacks.

4 PRIVACY OF MODELS

Model privacy concerns arise when outputs reveal private attributes used to train machine-learning models. The survey therefore considers privacy leakage from adopted models, not only from data.

  • A model’s privacy is breached when an adversary uses its output to infer private attributes used to train the model.

4.1 Membership Privacy

Membership privacy concerns whether a generative model reveals if specific data points belonged to its training set. The surveyed attacks and defenses use GAN-based inference or adversarial regularization, with privacy often balanced against utility and practical assumptions.

  • Membership inference attacks determine whether a specific data point appears in a model’s training dataset, creating privacy leakage risks.
  • LOGAN attacks generative models through black-box or white-box access, with white-box attackers using the target GAN’s generator and discriminator structure and parameters.
  • Black-box membership attacks may require impractical assumptions, including auxiliary data from training or test distributions.
  • Co-membership attacks jointly determine whether n data points are present in a target generative model’s training dataset, extending single-point membership inference.
  • Adversarial regularization trains a classifier against a membership attacker, but reduces classification accuracy by around 3% and requires substantial reference data.
  • Differentially private training can reduce membership leakage while improving model generalization by narrowing the generalization gap.

4.2 Preimage Privacy

Preimage privacy research studies attacks that recover or characterize private inputs from model outputs, alongside GAN-based mechanisms that preprocess data before service use. GANs can reduce inversion complexity, but access to sensitive data and unstable training remain concerns.

  • Model inversion and data reconstruction attacks aim to recover inputs or raw training data from a target model, potentially causing serious privacy damage.
  • GAN-based black-box inversion trains a generator with adaptive loss to characterize data belonging to a target label.
  • Black-box inversion can attack models trained with differential privacy, but requires many prediction queries, creating a major practical burden.
  • High-dimensional inputs make label-only inversion difficult, often producing unrecognizable representations that are not useful to attackers.
  • With domain information, GANs search a low-dimensional latent space and transfer the high-dimensional inversion problem into latent optimization.
  • CPGAN combines a privatization generator, prediction service, and mimic attacker to protect preimage privacy before machine-learning-as-a-service training.
  • CPGAN keeps sensitive information out of the service input, but its generator directly accesses sensitive data and GAN training may be difficult to converge.

4.3 Privacy in Distributed Learning Systems

Distributed learning avoids sharing raw data but introduces privacy risks involving local models, servers, user identities, and participation. GANs support both attacks that recover sensitive information and defenses that detect malicious parameter behavior.

  • Distributed learning trains geographically separated data locally, reducing raw-data sharing through schemes such as DSSGD and federated learning.
  • Distributed systems must protect membership, preimage, parameter, user-assignment, and participation privacy because attackers may target servers or local users.
  • A GAN attacker can impersonate an honest DSSGD participant and recover sensitive information for labels absent from the attacker’s local data.
  • A malicious server can train mGAN-AI to identify user-level information and generate sensitive data for target victim models without affecting system performance.
  • A buried point layer and server-side detection module are used to detect abnormal parameter changes caused by attackers.
  • Federated GANs enable distributed data generation when raw data cannot leave local datasets, extending federated learning beyond classifier training.

4.4 Differential Privacy in GAN

Differential privacy in GANs protects model privacy by perturbing training or discriminator information, while researchers also address utility, labeled data, and federated settings. The main trade-off is that stronger noise can reduce generated-data utility.

  • Model privacy leakage arises because training embeds information about data distributions, features, and membership into model parameters.
  • Regularization reduces overfitting, while acceptable noise can provide another route to limiting information leakage from learning models.
  • Acs et al. introduced a GAN-based private generative model that releases unlimited data with differential privacy and addresses limited data sources.
  • PATE-GAN uses teachers trained on disjoint datasets to produce noisy labels for a student discriminator, while generator and student jointly produce realistic private data.
  • DPGAN adds designed noise to gradients, adopts WGAN loss for quality and mode-collapse resistance, and avoids dependence on dataset partition parameter k.
  • Differentially private GAN methods also perturb discriminator gradients, extend to labeled data, and protect local generators in federated settings.
  • Privacy protection depends strongly on noise scale, which can introduce utility loss and remains an open research challenge.

5 SECURITY WITH GAN

GAN-based security methods address adversarial attacks against classifiers and generative models, as well as defenses that denoise or adversarially train classifiers. These approaches use GAN generators and discriminators to produce or remove adversarial behavior under different attack settings.

  • Adversarial Sample Attacks: Adversarial sample attacks modify inputs imperceptibly to mislead a classifier, either without a target label or toward an attacker-selected label.The attack objective minimizes distance from the original sample while inducing incorrect classification.
  • Adversarial Sample Attacks: GAN-based attacks can generate targeted adversarial samples directly from original data instead of optimizing additive noise.The approach trains a neural network to obtain an adversarial sample from the original input.
  • Adversarial Sample Attacks: A GAN combined with a data inverter maps normal inputs into latent representations used to generate realistic adversarial samples.WGAN generates data from latent noise, while the inverter supplies a representation corresponding to each normal input.
  • Adversarial Sample Attacks: Modified ACGAN and related models can produce unrestricted targeted adversarial samples that differ substantially from original data and may evade human detection.The attacker optimizes the victim-classifier prediction while preserving the intended label through an auxiliary classifier.
  • Attacks on Generative Models: GANs can also be attacked by optimizing inputs to generative models so their outputs receive a target classification.The objective combines input-distance and target-prediction losses.
  • Adversarial Sample Defense: GAN-based defenses include denoising, adversarial training, and detection, with denoising generators transforming adversarial samples into normal data.Defense-GAN instead reconstructs inputs through a generator trained on clean data.
  • Adversarial Sample Defense: Generative adversarial training addresses limited adversarial data by generating perturbations from normal-data gradients while constraining their size.The classifier is configured as the discriminator and trained on both normal and generated data.
  • Adversarial Sample Defense: GanDef provides a model-independent defense intended to operate across different classifiers.Its design is motivated by differences between adversarial and normal samples before the soft-max layer.

5.2 Malware Detection

GAN-based malware security methods generate adversarial malware examples, detect malware under black-box access, analyze malware representations, and extend detection toward zero-day threats.

  • Adversarial Malware Generation: MalGAN generates adversarial malware features against a black-box detector when the attacker knows detector features but not its algorithm or parameters.A substitute detector is used to approximate the inaccessible target detector.
  • Adversarial Malware Generation: GAN-based Android malware attacks alter malware code to change a classifier’s output from malware to benign.The attacker uses detection feedback without accessing the network’s internal architecture or parameters.
  • Malware Analysis: GANs support malware analysis by converting binary files into grayscale images for model training.The described collection includes WannaCry ransomware, a Linux SMB trojan, and a MySQL Trojan, represented as 32 × 32 images.
  • Malware Analysis: Federated GAN is proposed to defend against attacks while enabling devices to communicate efficiently and securely.
  • Zero-Day Malware: tDCGAN transfers malware characteristics learned with a deep autoencoder to train a generator for zero-day malware detection.Its architecture combines data compression and GAN-based generation.

5.3 Bioinformatic-based Recognition

GANs are applied to biometric recognition, face-recognition attacks, financial fraud detection, and botnet detection by synthesizing data or adversarial examples under constrained data-access conditions.

  • Bio-information Recognition: GAN-generated synthetic fingerprints can support fingerprint verification while avoiding direct publication of sensitive biometric databases.Reported methods search the latent space through evolutionary optimization or gradient-based search, and another approach uses a two-stage GAN.
  • Face Recognition: GAN-based face attacks combine makeup transfer with adversarial-example generation against trained face-recognition models.CycleGAN-style generators alter makeup while maintaining identity-related structure before the attack stage.
  • Face Recognition: MorGAN launches realistic face-morphing attacks by incorporating representation loss and a variational autoencoder.The variational formulation is intended to avoid discontinuous latent spaces and improve interpolation outputs.
  • Fraud Detection: Telecom fraud detection uses a coupled GAN, autoencoder, and Gaussian Mixture Model when receiving banks lack detailed information about sending accounts.The encoder and GMM form the discriminator, while the decoder acts as the generator.
  • Botnet Detection: GAN-based botnet detection augments detection models by replacing the discriminator with a detector whose output distinguishes normal, anomalous, and fake traffic.The three-way output is produced through a softmax function.

5.6 Network Intrusion Detection

GAN-based network intrusion systems generate training data, detect attacks in vehicular networks, and fuzz industrial protocols without relying solely on protocol grammar.

  • Network Intrusion Detection: Network intrusion detection is challenged by high-dimensional, high-volume traffic and insufficient attack samples submerged among normal packets.
  • Network Intrusion Detection: A DCGAN-LSTM method extracts intrusion features from raw data and generates new training datasets.The generator uses CNN architecture with fractional-stride convolutions, while LSTM learns intrusion-behavior features.
  • Vehicle Security: GIDS detects vehicular-network attacks on CAN buses using two discriminators and adversarially generated fake CAN images.The second discriminator is trained to distinguish real CAN images from generated images, including similar-looking fakes.
  • Industry Protocols: GAN-based industrial-protocol fuzzing trains an LSTM-based generator and CNN discriminator on real protocol messages to produce test messages.The generated messages are used in an automatic fuzzing framework rather than relying on protocol grammar.
  • Industry Protocols: Testing on several Modbus-TCP simulators successfully identified errors and vulnerabilities.

6 FUTURE WORKS

The survey identifies unresolved challenges for GAN-based privacy and security, including limited guarantees, incomplete modeling of structured data, costly assumptions, and unstable attack performance. It proposes future directions spanning model design, theoretical analysis, privacy-aware learning, and application-specific improvements.

  • Existing GAN approaches have not fully explored GAN’s potential for privacy and security, leaving substantial challenges and future research directions.The survey frames these challenges across application scenarios, model design, and data utilization.
  • 6.1 Privacy Protection: Current video and speech privacy methods often ignore spatio-temporal relations, which can expose side-channel information about individuals.Videos may be treated as independent image frames, while speech and video relations remain insufficiently incorporated into protection mechanisms.
  • 6.1 Privacy Protection: Current GAN privacy models do not identify which sensitive features are hidden or where noise is added, limiting protection against unmodeled privacy detectors.The generator’s black-box synthesis relies on discriminator feedback, so detectors excluded from training may still expose private information.
  • 6.1 Privacy Protection: All existing GAN-based privacy-preserving data-generation methods lack a theoretical privacy guarantee because unstable adversarial training makes generator capabilities unpredictable.The survey calls for technical breakthroughs that establish formal protection guarantees.
  • 6.2 Privacy Acquisition: GAN-based privacy attacks require substantial real data as prior knowledge, making their training assumption difficult to satisfy in practice.Transfer learning and probably approximately correct learning are proposed as possible ways to address this constraint.
  • 6.2 Privacy Acquisition: GAN privacy attacks lack theoretical analysis of why they work and how effective they can be, motivating PAC-learning analyses of sample requirements and attack success probability.The survey suggests deriving conditions such as the minimum training-dataset size needed for a target attack success probability.
  • 6.3 Security: GAN-based attack methods currently have lower attack success rates and higher training costs than traditional optimization-based attack methods.The survey links improvement opportunities to faster convergence, reduced mode collapse, and objectives that better target adversarial regions.
  • 6.3 Security: Dynamic malware analysis is more robust than static analysis, but existing tools are imperfect and use only a limited set of dynamic features.Future work includes virtualization-related analysis and side-channel analysis of attack behaviors.

7 CONCLUSION

The survey reviews GAN-based privacy and security approaches across diverse applications and analyzes their formulations and performance metrics. It concludes by identifying unresolved challenges and research directions involving application scenarios, model design, and data utilization.

  • The survey reviews state-of-the-art GAN approaches for privacy and security across image generation, video event detection, records publishing, distributed learning, malware detection, fraud detection, and other applications.It considers both attack and defense settings.
  • These approaches formulate attack and defense problems using GAN variants and evaluate factors including attack success rate, classification or prediction accuracy, and data utility.
  • The survey identifies unsolved challenges and promising research directions from the perspectives of application scenario, model design, and data utilization.
Loading 2106.03785v1…